mirror of
https://github.com/permissionlesstech/bitchat-android.git
synced 2026-10-25 07:40:36 +00:00
3c126b20db
SecurityManager.verifyPacketSignature only authenticates ANNOUNCE, MESSAGE, FILE_TRANSFER, VOICE_FRAME and LEAVE; every other type returns early as verified. REQUEST_SYNC is not in that set, so the sender ID is raw bytes off the wire and costs nothing to rotate. Keyed on that, the budget was bypassable: cycling more IDs than the LRU tracks gives every request a brand new bucket with a full allowance, so the flood this was meant to stop still went through. Found by Codex on the first push. Key it on RoutedPacket.ingressLinkID instead — assigned by the transport, never serialized onto the mesh, and distinct per link. A flooder is then bounded by the connections it can actually hold open rather than by the names it is willing to invent. Falls back to the sender ID only when a transport supplies no link identity.